---
id: CVE-2026-71862
title: >-
  Checkmate is an open-source, self-hosted tool designed to track and monitor
  server hardware, uptime, response times, and incidents in real-time with
  beautiful visualizations
summary: >-
  Checkmate is an open-source, self-hosted tool designed to track and monitor
  server hardware, uptime, response times, and incidents in real-time with
  beautiful visualizations. From 3.3.0 until 3.9.2, enabling the global showURL
  setting ca…
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N'
cwe:
  - CWE-200
  - CWE-522
published: '2026-08-21'
updated: '2026-09-18'
sourceUpdated: '2026-09-18T20:09:01.757'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-71862'
references:
  - url: >-
      https://github.com/bluewave-labs/Checkmate/commit/cc1814f507041bb0f64845bed5d5442c21e920f2
    label: security-advisories@github.com
  - url: 'https://github.com/bluewave-labs/Checkmate/pull/3758'
    label: security-advisories@github.com
  - url: 'https://github.com/bluewave-labs/Checkmate/releases/tag/v3.9.2'
    label: security-advisories@github.com
  - url: >-
      https://github.com/bluewave-labs/Checkmate/security/advisories/GHSA-3m74-8cg9-rp8j
    label: security-advisories@github.com
tags:
  - nvd
epss: 0.00353
epssPercentile: 0.29056
ingestedAt: '2026-09-18T20:51:25.656Z'
---

## Overview

Checkmate is an open-source, self-hosted tool designed to track and monitor server hardware, uptime, response times, and incidents in real-time with beautiful visualizations. From 3.3.0 until 3.9.2, enabling the global showURL setting causes the unauthenticated GET /api/v1/status-page/:url endpoint to return complete monitor objects from server/src/controllers/statusPageController.ts. The response includes the secret field used by HttpProvider.ts as an HTTP Authorization credential, even though BaseStatusPage.tsx does not display that value, allowing visitors to extract credentials from the JSON response and use them against monitored services. This issue is fixed in version 3.9.2.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.